WO1990010332A1 - Circuit de sortie de courant alternatif a surete integree et tolerant les pannes - Google Patents

Circuit de sortie de courant alternatif a surete integree et tolerant les pannes Download PDF

Info

Publication number
WO1990010332A1
WO1990010332A1 PCT/US1990/001096 US9001096W WO9010332A1 WO 1990010332 A1 WO1990010332 A1 WO 1990010332A1 US 9001096 W US9001096 W US 9001096W WO 9010332 A1 WO9010332 A1 WO 9010332A1
Authority
WO
WIPO (PCT)
Prior art keywords
switch
output
crowbar
switches
load
Prior art date
Application number
PCT/US1990/001096
Other languages
English (en)
Inventor
Kenneth J. Murphy
Original Assignee
Bh-F (Triplex) Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bh-F (Triplex) Inc. filed Critical Bh-F (Triplex) Inc.
Publication of WO1990010332A1 publication Critical patent/WO1990010332A1/fr

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/05—Programmable logic controllers, e.g. simulating logic interconnections of signals according to ladder diagrams or function charts
    • G05B19/054—Input/output
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01H—ELECTRIC SWITCHES; RELAYS; SELECTORS; EMERGENCY PROTECTIVE DEVICES
    • H01H47/00—Circuit arrangements not adapted to a particular application of the relay and designed to obtain desired operating characteristics or to provide energising current
    • H01H47/002—Monitoring or fail-safe circuits
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02H—EMERGENCY PROTECTIVE CIRCUIT ARRANGEMENTS
    • H02H3/00—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection
    • H02H3/02—Details
    • H02H3/021—Details concerning the disconnection itself, e.g. at a particular instant, particularly at zero value of current, disconnection in a predetermined order
    • H02H3/023—Details concerning the disconnection itself, e.g. at a particular instant, particularly at zero value of current, disconnection in a predetermined order by short-circuiting
    • H—ELECTRICITY
    • H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
    • H02H—EMERGENCY PROTECTIVE CIRCUIT ARRANGEMENTS
    • H02H3/00—Emergency protective circuit arrangements for automatic disconnection directly responsive to an undesired change from normal electric working condition with or without subsequent reconnection ; integrated protection
    • H02H3/02—Details
    • H02H3/04—Details with warning or supervision in addition to disconnection, e.g. for indicating that protective apparatus has functioned
    • H02H3/044—Checking correct functioning of protective arrangements, e.g. by simulating a fault

Definitions

  • This invention relates generally to fault- tolerant circuits and, more particularly, to output cir ⁇ cuits associated with fault-tolerant computers and in ⁇ dustrial controllers.
  • the concept of using multiple com- putational devices to maintain the integrity of a computer-controlled process has been known for some years.
  • the computational devices perform each function separately and the results are compared to determine the "correct" one.
  • a commonly employed configuration has three computational devices and the results are com ⁇ pared in a voting circuit, such that the best two of the three results is taken to be correct.
  • This voting con ⁇ cept may be applied to practically all operations per ⁇ formed by the computational devices, including access ⁇ ing data storage locations and performing arithmetic or logical computations.
  • a different, but related problem is the design of output circuits to have a similar type of multiple redundancy.
  • output There are two basic types of output from computational devices used as industrial controllers.
  • One type of output consists of "on” and “off” signals and is usually referred to as digital or binary.
  • the second type of output is in the form of an analog sig ⁇ nal, which might be used to control, for example, the position of a valve.
  • the valve in turn, can control a fluid flow rate, a pressure level, or some other physical parameter.
  • Digital output signals are used in control processes to turn direct-current (dc) motors on and off, to open and close solenoid-actuated valves, and to perform various other functions.
  • dc direct-current
  • the primary design constraint for a fail-safe operation of a digital output circuit is that it should not fail to an ON state when the desired switching func- tion is OFF. This may be achieved by connecting two re ⁇ dundant switches in series in an electrical circuit, and controlling the two switches with independently gen ⁇ erated redundant control signals. If one of the switch ⁇ es fails to respond to an OFF signal, the circuit will still be opened by the other switch. Such a circuit is tested by opening one switch while the other is closed, and checking for an open circuit that should have re ⁇ sulted from the open switch. Then the other switch is opened while the first is closed, again checking for an open circuit.
  • An alternative approach to obtaining fail-safe operation of ac output circuits is to use only a single output switch, but in conjunction with a "crowbar" switch and a fuse in the ac circuit.
  • the fuse and the single output switch are connected in series with a load being controlled.
  • the crowbar switch is connected across the ac power lines, essentially in parallel with the load. When the output switch fails to open on com- mand, the crowbar switch is closed, shorting out the power line and blowing the fuse to effect a disconnec ⁇ tion of the load.
  • Circuits of this general type have the advantage of using only one power-dissipating switch, and have been in use for some time, as exempli- fied by the protected ac output module for the General Electric Company Series Six programmable controllers.
  • the present invention resides in an ac output circuit for digital controller output signals, in which a single output switch is employed to control the out ⁇ put circuit in response to a voted control signal, and a crowbar switch is employed to disconnect the load in the event of failure of the output switch in an ON con ⁇ dition.
  • a crowbar switch is employed to disconnect the load in the event of failure of the output switch in an ON con ⁇ dition.
  • the circuit of the invention includes a fuse connected in one of the ac power lines, an output switch connected in series with the fuse, two crowbar switches connected in series across the ac power lines, means for closing the crow- bar switches together and blowing the fuse to discon ⁇ nect the load in the event that the output switch fails to open on command, and means for closing the crowbar switches independently to test their operation without blowing the fuse.
  • the circuit also includes a pair of current-limiting resistors connected in series between the two ac power lines, and current detection means connected to a junc ⁇ tion point between the two crowbar switches and to a junction point between the two resistors. Closure of either of the crowbar switches causes current flow through the current detection means and one of the resistors, but the current is not great enough to blow the fuse.
  • the circuit further includes an output current sensor coupled in series with the output switch, to detect current flow through the output switch, a dummy load connected in parallel with the load, and a dummy load switch in series with the dummy load.
  • the dummy load causes a detectable current flow when the output switch is switched on momentarily, regardless of the condition of the real load.
  • the dummy load switch is responsive only to a transi ⁇ tion from OFF to ON state of the output switch, and includes a positive temperature coefficient thermistor, which operates to limit current in the dummy load in the event that the dummy load switch fails in the ON state.
  • the circuit of the inven ⁇ tion includes means for independently generating mul- tiple control signals for operating the output switch, and means for ANDing the multiple control signals to minimize the number of erroneous switch-on signals applied to the output switch.
  • the means for closing the crowbar switches separately and together include means for independently generating multiple control signals for operating each crowbar switch, and means for logically ORing the multiple control signals for each crowbar switch, to close the crowbar switches even if only one of the multiple control signals com- mands the closure.
  • each of the switches including the output switch, the crowbar switches and the dummy load switch, in ⁇ cludes a solid-state switch device.
  • a single load is controlled by two identical guarded or fail-safe output modules, each with its own output switch, crowbar switches, dummy load, current detectors and diagnostic testing.
  • the load current may be shared between the output switches on the two modules and either module may pro ⁇ vide the full load current in the event that the other module fails in the OFF state.
  • Each of the two modules operates independently to control the load through its output switch and to disconnect the load by blowing a fuse if necessary.
  • the two modules together provide a higher degree of fault tolerance than a single fail ⁇ safe module by not only ensuring correct OFF state operation of the load, but also ensuring correct ON state operation of the load. Additionally, a failed module may be "hot-replaced,” without removing power from the system, to ensure the continued correct ON/OFF state of the load.
  • the present invention represents a significant advance in the field of digital output circuits for the control of ac loads.
  • the invention provides a fail-safe output circuit that will automatically discon ⁇ nect the load by closing a pair of crowbar switches to blow a power fuse upon detection that the output switch has failed to open on command.
  • the circuit permits routine testing of the crowbar switches without blowing the fuse, and routine testing of other compo ⁇ nents and modes of operation of the circuit.
  • FIGURE 1 is a simplified schematic diagram of a fail-safe switching circuit for controlling an ac load using a crowbar switch
  • FIG. 2 is a simplified schematic diagram of a 110-volt ac guarded output circuit in accordance with the invention
  • FIG. 3 is a timing diagram illustrating the sequence of events in a turn-ON test of the circuit of FIG. 2;
  • FIG. 4a is a timing diagram of the sequence of events that occurs during the blowing of a fuse when the circuit of FIG. 2 fails to respond to an OFF command;
  • FIG. 4b is a timing diagram of the sequence of events that occurs during the blowing of a fuse when the circuit of FIG. 2 detects output current in the OFF state of the output switch;
  • FIG. 5 is a simplified schematic diagram show ⁇ ing two circuits embodying the present invention, con ⁇ nected to a single load to provide fault-tolerant opera ⁇ tion.
  • the present invention is concerned with provi ⁇ ding fail-safe and fault tolerant operation in digital output circuits in industrial control systems and the like. Although such output circuits have been protected or guarded against possible component failure in prior control systems, these have had shortcomings that the present invention is designed to overcome.
  • FIG. 1 is a simplified schematic of a fail ⁇ safe output circuit using a single output switch, indi ⁇ cated by reference numeral 10, and a crowbar switch 12 operating in conjunction with a fuse 14.
  • Alternating- current (ac) power is supplied over input power lines 16 and 18 from an ac power source 19.
  • Line 16 is connected through the fuse 14 to the output switch 10, the other terminal of which is connected to an output line 20 that supplies power to a load 22.
  • the load 22 is connected by its other terminal to the other input power line 18.
  • the crowbar switch 12 is connected between the input power line 16, on the switch side of the fuse 14, and the other input power line 18.
  • the output switch 10 is controlled by a control signal A on line 24 and the crowbar switch 12 is controlled by a control signal B on line 26.
  • Control signal B is generated only when control signal A is signaling an OFF condition to the output switch 10, but the output switch is sensed as still being in the closed condition. This is contrary to the primary design constraint for fail-safe output circuits, namely that the circuit not provide an erro ⁇ neous ON condition when commanded to the OFF state.
  • control signal B which is normally in the OFF state, signals an ON command to the crowbar switch 12, the switch closes and a short-circuit current flows in the lines 16, 18, thereby blowing the fuse 14 and switching off the load as desired.
  • control signals A and B were derived from a common source. That is to say, a switch-on control signal B was generated only when control signal A was generating a switch-off signal, so it made sense to use the A switch-on control signal as an enabling signal for generating the control signal B.
  • the circuitry that generated control signal A was at fault, causing the output switch 10 to remain closed, this same error would be propagated into the generation of control signal B, and the crowbar switch 12 would not close as desired.
  • the circuit of FIG. 1 has two points of vulnerability from a fail-safe standpoint.
  • the crowbar switch 12 is itself vulnerable because there is no effective way to test it on a regular basis without blowing the fuse on each test and involving an operator to replace the fuse.
  • an error in the generation of the control signal that is intended to open the output switch 10 could also affect the crowbar switch 12 and prevent fail-safe operation of the circuit.
  • the output circuit of the invention also has an output switch 10, input power lines 16, 18 from an ac power source 19, and an output line 20 leading to a load 22.
  • the circuit also includes two resistors 30, 32 connected in series between the ac lines 16, 18, and a detector circuit 34 connected between the junction of the two resistors and the junction between the two crowbar switches 12a, 12b.
  • the circuit of the invention also includes an output current sensor 36 in series with the output switch 10, and a dummy load circuit extending between the load line 20 and input power line 18.
  • the dummy load circuit includes a dummy load 38 in the form of a thermistor, and a dummy load switch 40 in series with the dummy load. All four switches in the circuit, including the output switch 10, the crowbar switches 12a, 12b and the dummy load switch 40, are solid-state switches.
  • the output switch 10 is controlled by signals on line 24.
  • the control terminal of the dummy load switch 40 is ac-coupled to the same control line 24.
  • the upper and lower crowbar switches 12a, 12b are controlled by signals on lines 26a, 26b, respectively.
  • the voter circuits are interfaced with the microcomputers 44, 46 through respective bus control circuits 58, 60. Power from redundant sources is supplied to the micro ⁇ computers, bus control circuits and voters through three independently derived power supply lines 62a, 62b, 62c, and two dc to dc converters 64 and 65.
  • Each microcomputer 44, 46 receives signals from several sensors associated with the output cir ⁇ cuit. These include a switch sensor line 66 from the output current sensor 36, a crowbar switch sensor line 68 from the detector circuit 34, an ac zero crossing sensor line 70, and a blown fuse sensor line 72.
  • the switch sensor line 66 indicates to the microcomputers whether current is flowing through the output switch 10.
  • the crowbar sensor switch line 68 is used in test ⁇ ing the operation of the crowbar switches 12a, 12b.
  • the connections of the sensor lines 70 and 72 are not shown but are conventional in form.
  • the detec ⁇ tion of zero voltage crossings in an ac line is a well known function. Also, the detection of a blown fuse condition is easily effected by sensing the voltage across the fuse, which will be practically zero if the fuse is intact.
  • the microcomputers 44 and 46 generate output signals based on the desired digital outputs supplied by the voters 54, 56, and on the sensed signals re- ceived over lines 66, 68, 70, 72.
  • Microcomputer 44 generates output signals on three lines 80a, 82a and 84a.
  • the other microcomputer 46 generates corresponding outputs on lines 80b, 82b and 84b.
  • Signals on lines 80a and 80b are the output switch control signals. These are ANDed together in an AND gate 86, the output of which supplies control line 24 to the control terminal of the output switch 10.
  • Signals on lines 82a and 82b are to control the upper crowbar switch 12a.
  • signals on lines 84a and 84b are to control the lower crowbar switch 12b, and are ORed together in another OR gate 90, the output of which supplies control line 26b to the control terminal of the lower crowbar switch.
  • the output current sensor 36 monitors the state of the output switch, since a current will be detected if the switch is closed and a load is connected to the circuit. If the sensor 36 de ⁇ tects a current through the output switch when the switch has been commanded to the OFF state, the micro- computers 44, 46 each generate output signals to close both crowbar switches 12a, 12b. A series resistor 92 in the input power line 18 limits the short-circuit cur ⁇ rent to a safe operating level.
  • the dummy load 38 is a positive temperature coefficient thermistor, which is switched ON upon a transition of the output switch 10 from OFF to ON.
  • the signal pulse on line 24 needed to effect this transi ⁇ tion is also coupled to the dummy load switch 40, through a capacitor 93, which switches the dummy load into the circuit.
  • the dummy load remains connected until either the transitional energy coupled from line 24 is dissipated or the dummy load current crosses zero, and provides a path for current flow regardless of the external load connection. For each time that the output switch 10 is turned ON the microcomputers expect to see a current pulse caused by the temporary presence of the dummy load 38, indicating that the output switch 10 and current sensor 36 are functioning correctly.
  • the dummy load thermistor 38 also functions as a current limiter. Under normal operation the thermis ⁇ tor sees only an occasional current pulse and maintains a relatively low operating temperature and correspon ⁇ dingly low resistance. If the dummy load switch 40 were to fail in a closed condition, leaving the dummy load permanently connected, the temperature of the dummy load would rise, but its resistance would also rise, by several orders of magnitude, thereby limiting the dummy load current and the power dissipation to a relatively safe level. As in other output circuits, electrical isola ⁇ tion is maintained between the circuit logic that gener ⁇ ates switching control signals, and the load circuits being controlled. This is indicated diagrammatically in FIG. 2 by the dotted line 96.
  • Circuitry on one side of this line is referred to as being ,r on the logic side," while circuitry on the other side of the line is re ⁇ ferred to as being “on the load side.” Isolation can be provided by conventional means, such as combinations of light-emitting diodes and photoconductive cells. Diagnostic testing:
  • fault detection An important aspect of the design of fault- tolerant output circuits is fault detection. It is vital that provision be made to test all components of the circuit periodically, and to report any failure before a subsequent failure can render the whole cir ⁇ cuit unsafe. The following is a list of tests performed routinely by the microcomputers 44, 46. Errors are reported on a four-digit display (not shown) of conven ⁇ tional design.
  • Logic circuit verification The two microcompu ⁇ ters 44, 46 communicate over a serial communications link 94 to compare data received from the triple-redun ⁇ dant bus 50, and to compare data with respect to their internal memories and interrupt and timer circuits.
  • Ac line status Zero crossings from the ac lines, received on line 70, are checked for proper stability and frequency.
  • the AND gate 86 is checked to verify that each microcomputer can indepen- dently turn off the control signal 24 to the output switch 10. This test utilizes feedback from the logic side of the isolation line 96, to avoid interruption of operation of the output switch 10.
  • Switch turn-on test When the output switch 10 is in the OFF condition, it is turned ON briefly just prior to (or just after) each ac zero crossing so as not to disturb the load.
  • the dummy load 38 is switched on when the output switch transitions from the OFF to the ON condition, and provides a current path regard- less of the condition of the load.
  • the current sensor 36 provides an output that changes state on each suc ⁇ cessive half cycle that the test pulse is active, but only if the output switch can conduct in both direc ⁇ tions.
  • the waveform 100 indicates the timing of the zero crossings
  • waveform 102 shows the timing of the output switch commands for the turn-on test.
  • Waveform 104 shows the variations in load voltage that ensue from the switch ON commands
  • waveform 106 is the square-wave derived from the output current sensor 36 during this test.
  • Switch turn-off operation This is the fail ⁇ safe operation of the circuit.
  • the same action is taken if load current is sensed during the entire time that the output switch is commanded OFF, as illustrated by the timing diagram of FIG. 4b, in which the condition of the output switch command is indicated at 108', the sensed output current at 110', and the crowbar command signal at 112• .
  • Crowbar test This is the test employed to check both crowbar switches 12a, 12b without blowing the fuse 14. Each switch 12a or 12b is closed separate ⁇ ly, and the current flow is checked using the detector 34. If the crowbar can conduct in both directions, then the detector output will be a pulse train with a fre ⁇ quency that is twice the line frequency.
  • Open Load test If the output switch 10 is commanded to the ON condition but no current is detect- ed in the switch, a switch turn-on test is performed using a dummy load to determine if the output switch and output current sensor are working. If the test is successful, it is assumed that the load is open-circuit ⁇ ed.
  • Blown fuse test When a blown fuse is detect ⁇ ed, from a measurement of the voltage across the fuse 14, an appropriate error condition is indicated. If the crowbar switches 12a, 12b had been fired to blow the fuse, the condition will be reported as an output cir- cuit failure, which is the condition that caused the fuse to be blown.
  • two output mod- ules of the type described, as indicated at 120a and 120b in FIG. 5, are connected to common ac lines 16, 18 and to a single load 22 through a common load line 20.
  • Each module operates independently of the other to control the output state, to perform routine tests, and to blow its fuse with the crowbar switches if neces ⁇ sary.
  • the output switches 10 of the two modules 120a, 120b are effectively connected in parallel between the ac input line 16 and the load 22. If one module fails to switch its output switch OFF in response to a com- mand, operation of the crowbar switches in that module will blow the fuse and effectively remove the module from further operation. The remaining module, if still operating correctly, will continue to control the switching of the load. Indicators on the defective module will alert the operator and permit replacement of the module before a subsequent error is likely to occur on the remaining module.
  • the use of current sensing to detect correct operation of the output switch provides for indepen ⁇ dent error detection. If voltage sensing were used, the failure of one switch would be sensed as a failure in both modules, since the output switches are connected in parallel.
  • the drive voltage for each output switch is derived from an isolated power supply, as indicated at 122 in FIG. 2.
  • the drive volt ⁇ age for an output switch is derived from the voltage present at the switch terminal when the switch is open.
  • the drive voltage for each output switch is derived from an independent and isolated power source and the two switches can be closed, although connected in parallel. Current will flow through each output switch to the load, and the division of current through each switch will be deter ⁇ mined by how well their characteristics are matched.
  • the output circuit modules described may be conveniently fabricated to provide a number of indepen ⁇ dent output switches in a single circuit module.
  • the circuits have been configured to include sixteen on a single rack-mountable module.
  • the output circuits operate completely indepen ⁇ dently in an electrical sense, a portion of the circuit ⁇ ry relating to testing of the crowbar switches can be shared by multiple output circuits.
  • the circuit elements outlined by the envelope 130 in FIG. 2 is shared, including the lower crowbar switch 12b, the detector 34 and the resistors 30, 32 and 42.
  • the microcomputers 44, 46 are programmed to process digital output signals each receives from a controller, and to output these to the respective out ⁇ put switches. In addition, each microcomputer cycles through the various diagnostic tests on the output circuit.
  • the details of software implementation are straightforward and a matter of design choice.
  • the program may be written, for example, in assembly lan ⁇ guage for the INTEL 8031 microprocessor chip, manufac- tured by INTEL Corporation, Santa Clara, California 95051. Summary of features:
  • the most important features of the invention are the use of two crowbar switches, to permit automa ⁇ tic testing of crowbar switch operation without blowing the fuse, the use of an output current sensor to verify switching ON, and the use of the current sensor in con ⁇ junction with a dummy load to conduct a turn-on test when the output switch is OFF. These and other diagnos ⁇ tic features provide fail-safe and fault-tolerant oper- ation without any sacrifice in performance or testabi ⁇ lity of the circuit.
  • the present invention is embodied in components located on the load side of the isolation line 96 of FIG. 2.
  • the manner in which the control signals on lines 24, 26a and 26b are derived is not critical to the invention in its broadest sense.
  • the AND gate 86 and the OR gates 88 and 90 are used to combine two independently generated sets of control signals, but the details of operation of the microcomputers are not believed to be significant.
  • the microcomputers are shown as receiving digital output signals from voter circuits 54, 56, this aspect is not critical to the invention either. The digital outputs could be received on a single line, although the likelihood is that a fail ⁇ safe and fault-tolerant output circuit would only be used in conjunction with a multiple-redundant control ⁇ ler of some kind.
  • the present inven- tion represents a significant advance in the field of industrial-type controllers, and digital output cir ⁇ cuits in particular.
  • the invention pro ⁇ vides an ac digital output circuit that is fail-safe and may be connected in a fault-tolerant manner, large- ly because of the use of two crowbar switches instead of one, and a current sensor and dummy load for en ⁇ hanced diagnostic testing ability.
  • a number of embodiments of the invention have been described in detail for pur- poses of illustration, various modifications may be made without departing from the spirit and scope of the invention. Accordingly, the invention is not to be limited except as by the appended claims.

Abstract

L'invention concerne un circuit de sortie numérique protégé couplé à une unité de commande programmable, afin de commander une charge (22) alimentée par des lignes de haute intensité de courant alternatif (ca), comprenant un fusible (14) ainsi qu'un seul interrupteur de sortie (10) commandé, connecté en série à la charge, et une paire d'interrupteurs à levier (12a, 12b) connectés en série, connectés ensemble par les lignes de haute intensité ca. Lesdits interrupteurs à levier peuvent être commandés de manière rapprochée dans le cas où l'interrupteur de sortie est ouvert mais ne parvient pas à s'ouvrir, court-circuitant ainsi les lignes de haute intensité ca et déconnectant la charge en faisant sauter le fusible. Lors d'un test de routine, on peut fermer les interrupteurs à levier séparément afin de contrôler leur fonctionnement sans faire sauter le fusible. On utilise un circuit de détection de courant pour vérifier que du courant passe dans l'interrupteur à levier fermé. On utilise également un capteur de courant (36) afin de déterminer que du courant passe dans l'interrupteur de sortie, lorsqu'il est fermé afin de mettre la charge en circuit, ou pour un test de diagnostic de mise en circuit lorsque la charge est déconnectée.
PCT/US1990/001096 1989-02-27 1990-02-27 Circuit de sortie de courant alternatif a surete integree et tolerant les pannes WO1990010332A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US07/316,172 US4926281A (en) 1989-02-27 1989-02-27 Fail-safe and fault-tolerant alternating current output circuit
US316,172 1994-09-30

Publications (1)

Publication Number Publication Date
WO1990010332A1 true WO1990010332A1 (fr) 1990-09-07

Family

ID=23227823

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US1990/001096 WO1990010332A1 (fr) 1989-02-27 1990-02-27 Circuit de sortie de courant alternatif a surete integree et tolerant les pannes

Country Status (4)

Country Link
US (1) US4926281A (fr)
AU (1) AU5343990A (fr)
CA (1) CA2011007A1 (fr)
WO (1) WO1990010332A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0618518A1 (fr) * 1993-03-30 1994-10-05 Schneider Electric Sa Interface analogique de sécurité

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0771381B2 (ja) * 1991-08-09 1995-07-31 株式会社ピーエフユー 電源供給系評価装置
US5410193A (en) * 1992-10-02 1995-04-25 Eastman Kodak Company Apparatus and technique for connecting a source of zero crossing AC voltage to and disconnecting it from an AC load line
US5923830A (en) * 1997-05-07 1999-07-13 General Dynamics Information Systems, Inc. Non-interrupting power control for fault tolerant computer systems
US6351829B1 (en) * 1998-10-28 2002-02-26 Honeywell Inc System and method for distinguishing a device failure from an inter-device communication failure
US6236546B1 (en) * 1999-08-16 2001-05-22 Harris Corporation Crowbar circuit verification testing system
EP1207622B1 (fr) * 2000-11-21 2013-02-27 Omron Corporation Système de relais semi-conducteur
US6856045B1 (en) * 2002-01-29 2005-02-15 Hamilton Sundstrand Corporation Power distribution assembly with redundant architecture
AU2002950581A0 (en) * 2002-08-02 2002-09-12 Wayne Callen Electrical safety circuit
JP2007512185A (ja) * 2003-11-26 2007-05-17 リッテルフューズ，インコーポレイティド 車両用電気的保護装置、及び車両用電気的保護装置を使用するシステム
WO2006002695A1 (fr) * 2004-07-06 2006-01-12 Daimlerchrysler Ag Systeme redondant de bus de donnees
US20070159760A1 (en) * 2005-05-13 2007-07-12 Collins Clark Methods and Systems Related to Pulsed Power
US7761773B2 (en) * 2005-06-30 2010-07-20 Sigmatel, Inc. Semiconductor device including a unique identifier and error correction code
US20110175699A1 (en) * 2007-01-05 2011-07-21 Roy Allen Huss Fuse box system and method
US8686596B2 (en) * 2007-01-05 2014-04-01 Roy Allen Huss Fuse box system and method
WO2009114929A1 (fr) * 2008-03-17 2009-09-24 JPS Électronique Inc. Unité de commutation adaptée pour communiquer avec une unité de traitement
JP5117296B2 (ja) * 2008-06-24 2013-01-16 本田技研工業株式会社 発電機の並列運転接続装置
US8289665B2 (en) * 2009-07-17 2012-10-16 The Invention Science Fund I Llc Systems and methods for grounding power line sections to clear faults
US9071188B2 (en) * 2009-09-04 2015-06-30 Black & Decker Inc. Protective redundant subsystem for power tools
US20120243129A1 (en) * 2011-03-24 2012-09-27 General Electric Company Shorting protection for systems having electric machines
CN103018615B (zh) * 2011-09-23 2015-04-15 台达电子企业管理（上海）有限公司 一种在风电机组中用于检测撬棍电路的装置及其方法
EP2595019B1 (fr) 2011-11-17 2019-03-13 Rockwell Automation Limited Procédé et appareil de contrôle du courant de sortie analogique
JP5710516B2 (ja) * 2012-02-08 2015-04-30 オムロンオートモーティブエレクトロニクス株式会社 電源装置
DE102013101050B4 (de) 2013-02-01 2023-02-16 Pilz Gmbh & Co. Kg Sicherheitsschaltvorrichtung mit sicherem Netzteil
KR101552852B1 (ko) * 2014-12-15 2015-09-14 와이피피 주식회사 ３중화 디지털 보호 계전기 및 그 운영 방법
DE102017006633A1 (de) * 2017-07-13 2019-01-17 WAGO Verwaltungsgesellschaft mit beschränkter Haftung Schaltung zur Trennung eines Eingangs einer Umsetzeinrichtung von einer Spannungsversorgung bei Überspannung

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4351014A (en) * 1980-07-18 1982-09-21 Xenex Corporation Solid state self-checking relay
US4626952A (en) * 1984-08-27 1986-12-02 Mitsubishi Denki Kabushiki Kaisha Protection apparatus for a transistor inverter

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3475653A (en) * 1965-01-11 1969-10-28 Res Iii Inc Electrical circuit protector
US3600634A (en) * 1969-12-16 1971-08-17 Integrated Systems Inc Protective control circuit against transient voltages
US3968407A (en) * 1974-03-27 1976-07-06 Petrolite Corporation Redundant intrinsic safety barrier

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4351014A (en) * 1980-07-18 1982-09-21 Xenex Corporation Solid state self-checking relay
US4626952A (en) * 1984-08-27 1986-12-02 Mitsubishi Denki Kabushiki Kaisha Protection apparatus for a transistor inverter

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0618518A1 (fr) * 1993-03-30 1994-10-05 Schneider Electric Sa Interface analogique de sécurité
FR2703480A1 (fr) * 1993-03-30 1994-10-07 Merlin Gerin Interface analogique de sécurité.

Also Published As

Publication number Publication date
CA2011007A1 (fr) 1990-08-27
US4926281A (en) 1990-05-15
AU5343990A (en) 1990-09-26

Similar Documents

Publication Publication Date Title
US4926281A (en) Fail-safe and fault-tolerant alternating current output circuit
US4409635A (en) Electrical power system with fault tolerant control unit
CA1315407C (fr) Circuits de sortie insensibles aux defaillances
US3892954A (en) Programmable, tester for protection and safeguards logic functions
EP0241270B1 (fr) Circuit de surveillance autotesté
US5446451A (en) On board hot bearing detector system with fault detection
JPH04271229A (ja) 温度異常検出方式
US7149925B2 (en) Peripheral component with high error protection for stored programmable controls
US4612638A (en) Diagnostic protection circuit and method using tri-state control and positive feedback
US4697093A (en) Testable, fault-tolerant power interface circuit for controlling plant process equipment
US3748540A (en) Testing and monitoring system for redundant trip devices
US5613064A (en) Output network for a fault tolerant control system
US5574385A (en) Testable solid state switch and related method
US4687623A (en) Self-compensating voted logic power interface with tester
JP3802093B2 (ja) 時間プログラムに従ってスイッチング装置を操作する制御装置
JP2002501279A (ja) 交流電源スイッチを監視する回路
EP0221775A1 (fr) Logique de décision pour circuit de puissance et sa méthode de test
EP0887628B1 (fr) Système de sécurité
US5096147A (en) In-circuit contact monitor
JP3630824B2 (ja) 補助リレー駆動回路
US11781752B2 (en) Using diode rectification to determine igniter, inducer relay, and igniter relay faults
JPS6138363Y2 (fr)
JPS5942706Y2 (ja) 回路要素の故障検出装置
SU1691819A1 (ru) Устройство дл диагностировани радиоэлектронных объектов
JPS6277655A (ja) プログラマブルコントロ−ラの基板故障診断回路

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AU BR JP KR

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): AT BE CH DE DK ES FR GB IT LU NL SE